flagpro | 1b39dcc5de43d2840d6992a561e34eec[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
1b39dcc5de43d2840d6992a561e34eec.zip
Size 290KB
Sample240901-nxpkdazfjc
SHA256 7c8c098ea9e14f0708472aa795393094ba6f4ceea3297d0a47c2abff99eb42a1
MD5 bfdcd83b2b2a0138fad37908b5632ad7
SHA1 69e0d56b4f83766671ebf751941e33579a48bf6a
SHA512 d8b33f01f872b51f1bb7d76892ad687b4b601d032a4c8379d083259afa2d7fe3ba6688115a339bfdd5a8c3fcfaab16705e331bdab8ac39bfd4e0674aee9c39c4
SSDEEP 6144:GVq85WAuUEFoApPxZkOqCrXQiCZpOeKIH0P4oYtDMLh233A29:eN5RJEFoAppZZTTpC7PBS6Q29
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

downloader infostealer flagpro

Malware Config

Signatures

Detect Flagpro 1 IoCs

Detect FlagPro Stealer.

downloader infostealer

resource	yara_rule
static1/unpack001/e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876	family_flagpro

Flagpro family
flagpro

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876

File Explorer

1b39dcc5de43d2840d6992a561e34eec.zip

.zip 290KB
e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876

.exe 532KB

1b39dcc5de43d2840d6992a561e34eec.zip

SHA256 7c8c098ea9e14f0708472aa795393094ba6f4ceea3297d0a47c2abff99eb42a1
MD5 bfdcd83b2b2a0138fad37908b5632ad7
SHA1 69e0d56b4f83766671ebf751941e33579a48bf6a
SHA512 d8b33f01f872b51f1bb7d76892ad687b4b601d032a4c8379d083259afa2d7fe3ba6688115a339bfdd5a8c3fcfaab16705e331bdab8ac39bfd4e0674aee9c39c4
SSDEEP 6144:GVq85WAuUEFoApPxZkOqCrXQiCZpOeKIH0P4oYtDMLh233A29:eN5RJEFoAppZZTTpC7PBS6Q29
MD5 SHA1 SHA512 SSDEEP

Password

infected

e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876

IMPHASH 178d6f72c77b3a7784c0027a6bb97e64
SHA256 e81255ff6e0ed937603748c1442ce9d6588decf6922537037cf3f1a7369a8876
MD5 1b39dcc5de43d2840d6992a561e34eec
SHA1 abb567aadfbd5686b3fbed027dc297646e6bbf04
SHA512 1a63c915bf4a829bf3fdb50fdf8cd1dbdeebe0fc6265d5c45ed3eeec43be44f857aac7008c7ae453c0f859efa660ed4e77fb76ec9b83e5b5d5effd3bd4c0bdcb
SSDEEP 12288:f3kUNnIL4Qyva9myMBBWRb4omnOlydGuGEViW9bLMe:veL45a9c9oCOlydEU9nl
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Detect Flagpro

Detect FlagPro Stealer.

downloader infostealer
Unsigned PE

Checks for missing Authenticode signature.

Password

infected

Minor OS version

Major OS version

Entry point

174574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx GetFileTime MoveFileA HeapFree HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent ExitProcess VirtualProtect VirtualAlloc GetSystemInfo VirtualQuery RtlUnwind HeapReAlloc HeapSize GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate HeapDestroy VirtualFree GetTempPathW CreateMutexA GetCPInfo GetFileAttributesW GetOEMCP IsValidCodePage GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount GetTimeZoneInformation LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileA SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW GetProcessHeap SetEnvironmentVariableA GetStartupInfoW MultiByteToWideChar InterlockedCompareExchange CreatePipe LockResource LoadLibraryA GetProcAddress FileTimeToLocalFileTime SetErrorMode lstrlenA CreateFileW GetFullPathNameW GetVolumeInformationW FindFirstFileW FindClose GetCurrentProcess DuplicateHandle GetFileSize SetEndOfFile UnlockFile LockFile FlushFileBuffers SetFilePointer WriteFile TlsFree LocalReAlloc TlsSetValue TlsAlloc GlobalHandle GlobalReAlloc TlsGetValue LocalAlloc FileTimeToSystemTime GetThreadLocale InterlockedIncrement GlobalFlags EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSection GlobalFindAtomW GetVersionExW CompareStringW GetVersionExA FormatMessageW LocalFree MulDiv GetModuleHandleA GlobalUnlock FreeResource GlobalFree WritePrivateProfileStringW GlobalAddAtomW SetLastError GlobalDeleteAtom GetCurrentThread GetCurrentThreadId ConvertDefaultLocale EnumResourceLanguagesW lstrcmpA GetLocaleInfoW LoadLibraryW CompareStringA InterlockedExchange GlobalLock lstrcmpW GlobalAlloc FreeLibrary GetModuleHandleW GetModuleFileNameW lstrlenW RaiseException DeleteFileA GetCurrentProcessId DeleteFileW GetACP CloseHandle GetSystemTimeAsFileTime GetLastError ReadFile TerminateProcess SizeofResource Sleep WideCharToMultiByte GetTickCount InterlockedDecrement CreateProcessW LoadResource FindResourceW FindResourceExW QueryPerformanceCounter GetTempFileNameW

user32

PostThreadMessageW MessageBeep GetNextDlgGroupItem CharUpperW CharNextW InvalidateRgn InvalidateRect SetRect IsRectEmpty CopyAcceleratorTableW GetSysColorBrush ReleaseCapture FindWindowExW GetWindowLongW SendMessageA FindWindowW PostMessageW EnableWindow SendMessageW GetSystemMetrics AppendMenuW GetClientRect IsIconic GetSystemMenu CheckMenuItem EnableMenuItem GetMenuState ModifyMenuW GetParent GetFocus LoadBitmapW GetMenuCheckMarkDimensions SetMenuItemBitmaps RegisterWindowMessageW PostQuitMessage SetCursor MessageBoxW IsWindowEnabled RegisterClipboardFormatW GetWindowThreadProcessId SetWindowPos MapDialogRect SetWindowContextHelpId GetWindow ValidateRect GetCursorPos PeekMessageW UnregisterClassW LoadCursorW SetCapture ShowWindow MoveWindow SetWindowTextW IsDialogMessageW LoadIconW SendDlgItemMessageW SendDlgItemMessageA WinHelpW IsChild GetCapture GetClassLongW GetClassNameW SetPropW GetPropW RemovePropW SetFocus GetWindowTextW GetForegroundWindow GetTopWindow UnhookWindowsHookEx GetMessageTime GetMessagePos MapWindowPoints SetMenu SetForegroundWindow GetLastActivePopup UpdateWindow CreateWindowExW GetClassInfoExW GetClassInfoW RegisterClassW AdjustWindowRectEx EqualRect PtInRect GetDlgCtrlID DefWindowProcW CallWindowProcW GetMenu SetWindowLongW OffsetRect IntersectRect SystemParametersInfoA GetWindowPlacement GetWindowRect DestroyMenu CopyRect GetMenuItemID GetMenuItemCount GetSubMenu GetSysColor EndPaint BeginPaint GetWindowDC ReleaseDC GetDC ClientToScreen GrayStringW DrawTextExW DrawTextW TabbedTextOutW GetDesktopWindow SetActiveWindow CreateDialogIndirectParamW DestroyWindow IsWindow GetDlgItem GetNextDlgTabItem EndDialog SetWindowsHookExW CallNextHookEx GetMessageW TranslateMessage DispatchMessageW GetActiveWindow IsWindowVisible GetKeyState

advapi32

CredFree RegSetValueExW RegCreateKeyExW RegQueryValueW RegOpenKeyW RegEnumKeyW RegDeleteKeyW RegOpenKeyExW RegQueryValueExW RegCloseKey CredEnumerateA

ole32

CoRevokeClassObject OleInitialize CoFreeUnusedLibraries OleUninitialize CreateILockBytesOnHGlobal StgCreateDocfileOnILockBytes StgOpenStorageOnILockBytes CoGetClassObject OleIsCurrentClipboard CoTaskMemAlloc CoTaskMemFree OleFlushClipboard CoRegisterMessageFilter CLSIDFromString CLSIDFromProgID CoCreateInstance CoUninitialize CoInitialize

oleaut32

SafeArrayDestroy SafeArrayCreate SafeArrayGetElemsize SafeArrayAccessData SafeArrayUnaccessData LoadRegTypeLi DispCallFunc SysAllocStringLen VariantChangeType VariantCopy VariantClear SysFreeString VariantInit SysStringLen SysAllocString SystemTimeToVariantTime OleCreateFontIndirect VariantTimeToSystemTime

shlwapi

PathFindFileNameW PathStripToRootW PathIsUNCW PathFindExtensionW

crypt32

CryptUnprotectData

gdi32

CreateBitmap RestoreDC SetBkColor SetTextColor SetMapMode GetClipBox DeleteObject GetObjectW GetViewportExtEx GetWindowExtEx PtVisible RectVisible TextOutW ExtTextOutW Escape SelectObject SetViewportOrgEx OffsetViewportOrgEx SetViewportExtEx ScaleViewportExtEx SetWindowExtEx ScaleWindowExtEx ExtSelectClipRgn DeleteDC GetStockObject GetDeviceCaps CreateRectRgnIndirect GetRgnBox GetBkColor GetTextColor GetMapMode SaveDC

comdlg32

GetFileTitleW

winspool.drv

OpenPrinterW DocumentPropertiesW ClosePrinter

comctl32

InitCommonControlsEx

oledlg

OleUIBusyW